Critical Security Update for Aardvark-DNS: Denial of Service Vulnerabilities
Summary
ALSA-2026:35833: Important: container-tools:rhel8 security update. Affects aardvark-dns across 4 version ranges.
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
< 2:1.10.1-2.module_el8.10.0+4047+545787c4
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aardvark-DNS package is a DNS resolver designed for use in containerized environments, particularly within the AlmaLinux ecosystem. It facilitates DNS resolution for applications running in containers, ensuring that they can communicate effectively over the network. This package is part of the container-tools module, which includes tools like Podman, Buildah, and Skopeo. The recent vulnerabilities identified in this module could potentially disrupt the functionality of applications relying on Aardvark-DNS, leading to service outages or degraded performance.
Vulnerability Detail
The vulnerabilities stem from multiple Denial of Service (DoS) issues found in the container-tools module, particularly affecting the Aardvark-DNS package. These vulnerabilities arise from improper handling of crafted JSON Web Encryption (JWE) objects and excessive parameters in public keys, which can lead to resource leaks and security bypasses. Attackers could exploit these vulnerabilities to cause service disruptions, making the affected systems unresponsive or leading to unauthorized access to sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update aardvark-dns-
< 2:1.10.1-2.module_el8.10.0+3901+4b80ecd72:1.10.1-2.module_el8.10.0+3901+4b80ecd7 -
< 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb72:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 -
< 2:1.10.1-2.module_el8.10.0+4047+545787c42:1.10.1-2.module_el8.10.0+4047+545787c4 -
< 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe2:1.10.1-2.module_el8.10.0+4089+ce72bbbe
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can limit the exposure of the Aardvark-DNS service by implementing network policies that restrict access to trusted sources only. Additionally, consider monitoring logs for unusual activity that may indicate attempts to exploit these vulnerabilities.
Conclusion
The identified vulnerabilities in the Aardvark-DNS package pose significant risks to applications relying on it for DNS resolution. Immediate action is required to update the package to the latest version to mitigate these risks. Users are encouraged to monitor their systems and apply best practices for security.
See every vulnerability recorded for aardvark-dns →
FAQ
The vulnerabilities primarily involve Denial of Service attacks that can disrupt the functionality of the DNS resolver.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement network restrictions and monitor for suspicious activity as a temporary workaround.
Yes, several packages within the container-tools module are affected, including Buildah, Podman, and Skopeo.
It is recommended to regularly check for updates, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for aardvark-dns.
